All checks
High
VPC default security groups should not allow inbound or outbound traffic
Confirms that each VPC's default security group has no inbound or outbound rules. AWS attaches this group to resources launched without one and it cannot be deleted, so emptying it stops it granting traffic nobody chose.
- service
- EC2
- severity
- High
- scope
- evaluated in every region
How to fix it
- Can break clients: Anything still attached to the default group, or launched later without a group, loses the traffic these rules allowed, so move workloads to their own groups first.
In the console
EC2 → Security Groups → the VPC's default group
- Inbound rules
- None: delete every rule
- Outbound rules
- None: delete every rule
With Terraform
resource "aws_default_security_group" "this" {
vpc_id = aws_vpc.this.id
}See which of your accounts this check is failing on.
Book a live scan